freeipa

#6891 Move FreeIPA SELinux policy from system policy to project policy
Closed: fixed by abbra. Opened by mkosek.

Closed: fixed
Reopen Issue

FreeIPA package had own SELinux module in the past, but which was removed after the work done in tickets #3683, #3684 (commit ad6abdb576b2ebeb941eb99fd141bf78918143c1) as it as a burden for development and slowing down installation significantly.

However, with recent development in SELinux modularization (like in this blog or that more recent blog), SELinux should be able to handle SELinux modules much better and thus removed the obstacle that let us move the policy to FreeIPA itself.

Having policy directly in FreeIPA would enable:

  • Much faster changes to policy as we would not have to depend on OS global policy and request changes there via Bugzillas (in Fedora, RHEL, CentOS)
  • More closely binding FreeIPA code and SELinux policy that allows that code. Having these parts shipped would let us enforce SELinux conformance when code is submitted, i.e. having both code and SELinux policy change in a Pull Request.
  • Enabling multiple different versions of FreeIPA on one underlying operating system without either having the system policy support both FreeIPA versions or not being able to upgrade at all (imagine FreeIPA with and without privilege separated Web service)
  • Enabling more advanced deployments, like with Fedora Modularity which expect that a system can handle multiple versions of the software

To be investigated before starting projects:

  • How to handle policies of FreeIPA dependencies, like 389-ds-base, pki-core or Apache?

While reading the first link, I noticed the next blog posting about policy priority. It even uses ipa has example policy. It could be useful to keep the baseline policy in the system policy but override aspects within FreeIPA.

Good point. But before any actual development starts, we need to talk to Fedora SELinux team anyway, to learn the current best practices in project SELinux modules - even the blog you mentioned is more than a year old and I know the SELinux team was investing a lot in this area.

Metadata Update from @pvoborni:
- Issue priority set to: critical
- Issue set to the milestone: FreeIPA 4.7

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1461919

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1461919

Issue linked to bug 1461919

SELinux policy should also cover ipa-custodia.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1323470
Dependency: #6888

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone

Master:

  • 5b573bb9a34fec5d34a4509c68015951ec6669b9: Add freeipa-selinux subpackage
  • 9288901f9be4f71894a0ee69f3996b680ba3dca0: Integrate SELinux policy into build system
  • 0c9949e8983e4befacbd4a40b5440008474a75a3: selinux: move BUILD_SELINUX_POLICY definition
  • 473f9baf26761cc70a0c36fe5d94446213509eb5: selinux: Remove obsolete memcached access

Metadata Update from @cheimes:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1461914 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1461919)
- Issue assigned to cheimes
- Issue set to the milestone: FreeIPA 4.8.5 (was: FreeIPA 4.7.1)

ipa-4-8:

  • 4ca100999b691c22ff63154edd32af0e8040ef1f Add freeipa-selinux subpackage
  • 18ce2033c04aed2c4a34f61b9ee3642b01f53017 Integrate SELinux policy into build system
  • bb6a5a5d9f850bde9b8d81c2dd51d41263c22cd4 selinux: move BUILD_SELINUX_POLICY definition
  • 96565414b3fd1e2c946b21f205a3ac3c4b5bad0c selinux: Remove obsolete memcached access

master:

  • b88562b2c866eef0b75e1aca9b32d55fbc2b3a8d Cleanup SELinux policy

ipa-4-8:

  • 87e0d82dd4409cdecaacee1fa27d27033aa65f7a Cleanup SELinux policy

master:

  • a55a722237b2d32c55eddddfb9c753c06e1eb5ee Integrate ipa_custodia policy
  • d23322434f71c02505b4b85e85e184d274eaeb2d Move freeipa-selinux dependency to freeipa-common

ipa-4-8:

  • 04cc0450125e3c9e989c3e769a25ba2f1f336060 Integrate ipa_custodia policy
  • 7d525ab4308060435808a311de55a76fb26a28c6 Move freeipa-selinux dependency to freeipa-common

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 3aad16a75ef06d20d111773268df30ee04274db7 selinux: disable ipa_custodia when installing custom policy

ipa-4-8:

  • f99cfa1443dfa33422eb4a7613d3dd9e921ccacd selinux: disable ipa_custodia when installing custom policy
Metadata
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.